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DETAILED ACTION 

1. This action is responsive to the communication filed on October 02, 2007. 
Claims 1-43 are pending. At this time, claims 1-43 are rejected. 

Response to Arguments 

2. Applicant's arguments filed October 2, 2007 under 35 USC § 101 have 
been fully considered but they are not persuasive. 

Applicant argues that claims 1,13, 20, and 30 are statutory and has 
given a few court case in the remarks to rescue and support for all the independent 
claims was being rejected as a non-statutory subject in the rejection mailed on April 2, 
2007. 

Examiner respectfully disagrees with the applicant and still maintain 
the rejection under 35 USC § 101. 

With regard to claim 1 , Applicant recites the claimed language "a 
malicious code analyzer disposed in a communication system traffic pattern between an 
originator of an information communication of said communication system traffic pattern 
and an intended recipient of said information communication to intercept said 
information communication and to analyze said information communication for malicious 
code, said malicious code analyzer being configured to be transparent to systems of 
said communication system." It appears that there is no process, machine, 
manufacture, or composition of matter in the claimed language. In fact, in which way 
would "a malicious code analyzer disposed in the communication system [a] traffic 
pattern". Nothing here shows that a useful, concrete, and/or tangible result can 
comprehend with this malicious code analyzer that link to [a] traffic pattern. Moreover, 
applicant further recites, "said malicious code analyzer being configured to be 
transparent to systems of said communication system." How can said malicious code 
analyzer being configured for transparency, per se, if indeed said malicious code 
analyzer is a "real" system or machine. Applicant is required to elaborate the claimed 
language to show the real meaning of the configuration of the transparency. From the 
technical point of view, the term transparency can be interpreted as either hardware 
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and/or software. Since, it is unclear to the examiner in which way would a malicious 
code configure to be transparent, examiner interprets the best understanding of the 
claimed language as recited by the applicant. Thus, claim 1 is non-statutory. 

With regard to claim 13, the computer program product having a 
computer readable medium having computer program is not well define any where in 
the specification, and the claimed language direct clearly toward a computer program. 
Besides, the specification does mention various computer programs and systems have 
been developed to facilitate such information communication (see paragraph 0003 of 
the specification). Thus claim 13 is a non-statutory. 

With regard to claims 20 and 30, applicant recites a method and a 
system for providing protection against malicious code. These claims also are non- 
statutory, because of the evidence of claims 1 and 13. 

For the above reasons, it is believed that the rejections under 35 
USC § 101 should be sustained. 

Applicant's arguments filed October 2, 2007, with respect to the 
rejection(s) of claim(s) 1-43 under 35 USC § 102 and 35 USC § 103 have been fully 
considered and are persuasive. Therefore, the rejection under 35 USC § 102 and 35 
USC § 103 has been withdrawn. However, upon further consideration, a new ground(s) 
of rejection is made in view of Kouznetsov et al (US 7,096,501 B2) and Desai et al (US 
' 7,203,192 B2). 

Claim Rejections - 35 USC § 101 

3. 35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or composition 
of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the 
conditions and requirements of this title. 

4. Claims 1-43 are rejected under 35 U.S.C. 101 because the claimed 
invention is directed to non-statutory subject matter. 

a. Referring to claims 1. 13. 20. and 30: 
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Claims 1, 13, 20, and 30 recite "a system, a computer program 
product, and a method for providing protection against malicious code." It appears that 
there is no process, machine, manufacture, or composition of matter in the claimed 
language. These claims are clearly directed toward a software program and they are 
non-statutory as not being tangibly embodied in a manner so as to be executable. 
Furthermore, the computer program product having a computer readable medium having 
computer program is not well define any where in the specification, and the claimed 
language direct clearly toward a computer program. Besides, the specification does 
mention various computer programs and systems have been developed to facilitate such 
information communication (see paragraph 0003 of the specification). Thus, claim 13 is 
a non-statutory. With regard to claims 20 and 30, applicant recites a method and a 
system for providing protection against malicious code. These claims also are non- 
statutory, because of the evidence of claims 1 and 13. Therefore, claims 1,13, 20, and 
30 recite a non-statutory subject matter. For more explanation under 101 non-statutory 
rejection of these above claims, please see "Response to Argument" that has been 
addressed above. 

Claims 2-12, 14-19, 21-29, and 31-43 are depended on claims 1, 
13, 20, and 30, respectively, thus they are rejected with the same rationale applied 
against claims 1, 13, 20, and 30 above. 

Claim Rejections - 35 USC § 103 

5. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for 

all obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

6. Claims 1, 3, 8-11 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Muttik (US 6,775,780 B1), and further in view of Kouznetsov et al 
(US 7,096,501 B2). 

a. Referring to claim 1: 
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i. Muttik teaches a system for providing protection against 
malicious code (see Figure 2 of Muttik): 

(1) a malicious code analyzer disposed in a 
communication system traffic pattern between an originator of an information 
communication of said communication system traffic pattern and an intended recipient 
of said information communication to intercept said information communication and to 
analyze said information communication for malicious code, said malicious code 
analyzer being configured to be transparent to systems of said communication system 
(see Figure 2, element 108 and column 1, line 65 through column 2, line 11 of 
Muttik). 

ii. Although Muttik teaches a system for providing protection 
against malicious code (see Figure 2 of Muttik), Muttik is silent on the capability of 
showing the malicious code analyzer being configured to be transparent to system of 
said communication system. On the other hand, Kouznetsov teaches this limitation in 
column 13, lines 22-29 of Kouznetsov). 

iii. It would have been obvious to a person having ordinary skill 
in the art at the time the invention was made to: 

(1) have modified the invention of Muttik with the 
teaching of Kouznetsov or detecting malicious software by analyzing patterns of system 
calls generated by the software during emulation (column 1, lines 10-12 of Muttik). 

iv. The ordinary skilled person would have been motivated to: 
(1) have modified the invention of Muttik with the 

teaching of Kouznetsov to detect malicious software without requiring manual analysis 
of the software by a human expert, and without exposing the computer system to 
potentially malicious actions of the software (column 1, lines 59-63 of Muttik). 

b. Referring to claim 3: 

i. Muttik further teaches: 

(1) wherein said transparent configuration of said 
malicious code analyzer comprises: a translate function that monitors each packet 



Application/Control Number: 

10/727,068 

Art Unit: 2135 



Page 6 



provided to an interface of said system for packets to be provided malicious code 
analysis by said malicious code analyzer (column 1, lines 40-47; column 3, line 65 
through column 4, line 11 of Muttik). 

c. Referring to claim 8: 

i. The combination of teaching between Muttik and 
Kouznetsov teaches the claimed subject matter. Kouznetsov further teaches: 

(1) wherein said malicious code analyzer comprises: 
code for virus scanning (column 1, lines 42-44, column 4, lines 37-38 of 
Kouznetsov). 

d. Referring to claim 9: 

i. Muttik further teaches: 

(1) wherein said malicious code analyzer comprises: 
code for identifying unwanted or unsolicited messages (column 3, lines 49-52 of 
Muttik). 

e. Referring to claim 11: 

i. Muttik further teaches: 

(1) a communications throttle for determining if said 
information communication is to be passed by said system (see Figure 2, element 212 
and column 4, lines 8-11 of Muttik). 

7. Claim 10 is rejected under 35 U.S.C. 103(a) as being unpatentable over 
Muttik (US 6,775,780 B1), in view of Kouznetsov et al (US 7,096,501 B2), and further in 
view of Desai et al (US 7,203,1 92 B2). 

a. Referring to claim 10: 

i. This claim has limitations that is similar to those of claim 3, 
thus it is rejected with the same rationale applied against claim 3 above. 

ii. Although the combination of teaching between Muttik and 
Kouznetsov teaches the claimed subject matter, they are not clear and/or silent on the 
capability of showing the steering module. On the other hand, Desai teaches this 
limitation in column 3, lines 14-27 of Desai. 
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iii. It would have been obvious to a person having ordinary skill 
in the art at the time the invention was made to: 

(1) have modified the modified-invention of Muttik with 
the teaching of Desai or detecting malicious software by analyzing patterns of system 
calls generated by the software during emulation (column 1, lines 10-12 of Muttik). 

iv. The ordinary skilled person would have been motivated to: 
(1) have modified the modified-invention of Muttik with 

the teaching of Desai to detect malicious software without requiring manual analysis of 
the software by a human expert, and without exposing the computer system to 
potentially malicious actions of the software (column 1, lines 59-63 of Muttik). 

8. Claims 13-14, 16-22, 26-34, 40-43 are rejected under 35 U.S.C. 103(a) as 
being unpatentable over Muttik (US 6,775,780 B1), and further in view of Desai et al 
(US 7,203,192 B2). 

a. Referring to claim 13: 

i. This claim consist a computer program product having a 
computer readable medium having computer program logic recorded thereon for 
providing protection against malicious code to implement claims 1 (without the 
transparency) and 10; thus it is rejected with the same rationale applied against claims 
1 (without the transparency) and 10 above. 

b. Referring to claim 14: 

i. This claim has limitations that is similar to those of claim 3, 
thus it is rejected with the same rationale applied against claim 3 above. 

c. Referring to claims 16. 26: 

i. These claims have limitations that is similar to those of claim 

8, thus they are rejected with the same rationale applied against claim 8 above. 

d. Referring to claims 17. 27: 

i. These claims have limitations that is similar to those of claim 

9, thus they are rejected with the same rationale applied against claim 9 above. 
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e. Referring to claims 18, 28: 

i. These claims have limitations that is similar to those of claim 
3, thus they aer rejected with the same rationale applied against claim 3 above. 

f. Referring to claims 19, 29: 

i. These claims have limitations that is similar to those of claim 
1 1 , thus they are rejected with the same rationale applied against claim 1 1 above. 

g. Referring to claim 20: 

i. Muttik teaches a method for providing protection against 
malicious code (see Figure 2 of Muttik): 

(1) intercepting packets in an information communication 
traffic pattern (column 4, lines 59-64; column 5, lines 1-13 of Muttik); 

(2) analyzing said at least a portion of said packets by 
said malicious code analyzer before releasing said at least a portion of said packets 
back into said traffic pattern (column 3, lines 54-57 of Muttik). 

ii. Although Muttik teaches the method for providing protection 
against malicious code, Muttik is not clear and/or silent on the capability of steering said 
packets between interfaces associated with an information communication originator 
and said intended recipient, said steering providing detouring of at least a portion of said 
packets to a malicious code analyzer. On the other hand, Desai teaches this limitation 
in the abstract and in column 3, lines 8-30 of Desai. 

iii. It would have been obvious to a person having ordinary skill 
in the art at the time the invention was made to: 

(1) have modified the modified-invention of Muttik with 
the teaching of Desai or detecting malicious software by analyzing patterns of system 
calls generated by the software during emulation (column 1, lines 10-12 of Muttik). 

iv. The ordinary skilled person would have been motivated to: 
(1) have modified the modified-invention of Muttik with 

the teaching of Desai to detect malicious software without requiring manual analysis of 
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the software by a human expert, and without exposing the computer system to 
potentially malicious actions of the software (column 1, lines 59-63 of Muttik). 

h. Referring to claim 21: 

i. This claim has limitations that is similar to those of claim 20, 
thus it is rejected with the same rationale applied against claim 20 above. 

i. Referring to claim 22: 

i. Muttik further teaches: 

(1) wherein said protective system is disposed as a 
protected network edge device (see Figure 1 and column 3, lines 22-53 of Muttik). 
j. Referring to claim 30: 

i. This claim has limitations that is similar to those of claimsl 
(without the transparency), 3, and 10, thus it is rejected with the same rationale applied 
against claims 1 (without the transparency), 3, and 10 above, 
k. Referring to claims 31-34, 40-43: 

i. These claims have limitations that is similar to those of 
claims 20-22 and 26-29, thus they are rejected with the same rationale applied against 
claims 20-22 and 26-29 above. 

9. Claims 2, 4-7, 12 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Muttik (US 6,775,780 B1), in view of Kouznetsov et al (US 7,096,501 
B2), and further in view of Mathon et al (US 7,032,005 B2). 

b. Referring to claim 2: 

i. Although the combination of teaching between Muttik and 
Kouznetsov teaches a system for providing protection against malicious code (see 
Figure 2 of Muttik), they are silent on the capability of not having a network address 
(e.g., zero footprint) associated therewith which is visible external to said system. On 
the other hand, Mathon teaches: 

(1) wherein said transparent configuration of said 
malicious code analyzer comprises said malicious code analyzer not having a network 
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address associated therewith which is visible external to said system (column 7, lines 
1-10 of Mathon). 

iii. It would have been obvious to a person having ordinary skill 
in the art at the time the invention was made to: 

(1) have modified the modified-invention of Muttik with 
the teaching of Mathon to secure communication over the Internet (column 1, lines 19- 
20 of Mathon). 

iv. The ordinary skilled person would have been motivated to: 

(1) have modified the modified-invention of Muttik with 
the teaching of Mathon to detect malicious software without requiring manual analysis of 
the software by a human expert, and without exposing the computer system to 
potentially malicious actions of the software (column 1, lines 59-63 of Muttik). 

b. Referring to claim 4: 

i. Muttik and Mathon further teaches: 

(1) wherein said malicious code analyzer comprises: a 
proxy (column 7, line 3 of Mathon) for emulating a behavior of a destination of said 
information communication (column 3, lines 54-65 and column 4, lines 17-24 of 
Muttik). 

c. Referring to claim 5: 

i. The combination of teaching between Muttik, Kouznetsov, 
and Mathon teaches the claimed subject matter. Mathon further teaches: 

(1) wherein said transparent configuration of said 
malicious code analyzer renders said proxy invisible to devices coupled to said system 
(column 7, lines 1-10 of Mathon). 

d. Referring to claim 6: 

i. The combination of teaching between Muttik, Kouznetsov, 
and Mathon teaches the claimed subject matter. Mathon further teaches: 
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(1) wherein said proxy comprises: server functionality; 
and client functionality (column 7, line 3; column 3, line 7; column 9, lines 20-35 
of Mathon). 

e. Referring to claim 7: 

i. The combination of teaching between Muttik, Kouznetsov, 
and Mathon teaches the claimed subject matter. Mathon further teaches: 

(1) a loop back interface for interfacing said information 
communication with said malicious code analyzer (column 1, lines 40-47 of Muttik; 
column 3, line 35 of Mathon). 

f. Referring to claim 12: 

i. The combination of teaching between Muttik, Kouznetsov, 
and Mathon teaches the claimed subject matter. Mathon further teaches: 

(1) wherein said information communication conforms to 
a protocol selected from the group consisting of: simple mail transfer protocol (SMTP); 
post office protocol (POP); hypertext transfer protocol (HTTP); Internet message 
access protocol (IMAP); file transfer protocol (FTP); domain name service (DNS); hot 
standby router protocol (HSRP); open shortest path first (OSPF); and enhanced 
interior gateway routing protocol (EIGRP) (column 7, line 32 of Mathon). 

10. Claims 15, 23-25, and 35-39 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Muttik (US 6,775,780 B1), in view of Desai et al (US 7,203,192 B2), 
and further in view of Mathon et al (US 7,032,005 B2). 

g. Referring to claim 15: 

i. This claim has limitations that is similar to those of claim 6, 
thus it is rejected with the same rationale applied against claim 6 above. 

h. Referring to claim 23: 

i. This claim has limitations that is similar to those of claim 5, 
thus it is rejected with the same rationale applied against claim 5 above. 
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i. Referring to claim 24: 

i. This claim has limitations that is similar to those of claims 3 
and 4, thus it is rejected with the same rationale applied against claims 3 and 4 above. 

j. Referring to claim 25: 

i. This claim has limitations that is similar to those of claim 6, 
thus it is rejected with the same rationale applied against claim 6 above. 

k. Referring to claims 35-39: 

i. These claims have limitations that is similar to those of 
claims 7 and 23-25, thus they are rejected with the same rationale applied against 
claims 7 and 23-25 above. 

Conclusion 

1 1 . The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. 

a. Hoffman (US 6,732,279 B2) discloses anti-virus protection system 
and method(see title). 

Any inquiry concerning this communication or earlier 
communications from the examiner should be directed to Thanhnga (Tanya) Truong 
whose telephone number is 571-272-3858. 

If attempts to reach the examiner by telephone are unsuccessful, 
the examiner's supervisor, Kim Vu can be reached at 571-272-3859. The fax and 
phone numbers for the organization where this application or proceeding is assigned is 
571-273-8300. 

Any inquiry of a general nature or relating to the status of this 
application or proceeding should be directed to the receptionist whose telephone 
number is 571-272-2100. 
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